Virus-fighting utilities

For your convenience in this section we gathered all virus-fighting utilities developed by Kaspersky Lab and the recommendations how to use them. If you failed to find the necessary information or you find these recommendations too complicated or inadequate, please send a request to Kaspersky Lab’s virus analysts to newvirus@kaspersky.com.

Utility	Command line
klwk.com download [ZIP, 166 KB] more information	/s - to force scanning of hard drives. Program will scan hard drives for infection in any case. /n - to force scanning of mapped network drives. /path - to force scanning specified path /y - end program without pressing any key. /i - show command line info. /nr - do not reboot system automatically in any case. /Rpt[a][o][=] - create report file a - add report file o - report only (do not cure/delete infected files)
clrav.com download [ZIP, 144 KB] more information	/s[n] - to force scanning of hard drives. Program will scan hard drives for I-Worm.Klez.a(e,f,g,h) infection in any case. n - include scanning of mapped network drives. /y - end program without pressing any key. /i - show command line info. /nr - do not reboot system automatically in any case. /Rpt[a][o][=] - create report file a - add report file o - report only (do not cure/delete infected files)
KL Anti-FunLove download [EXE, 61 KB] more information	/i - to install programm. /u - to uninstall programm. /hide[i][s] - hide i - installation window s - work window
Anti-Nimda download [ZIP, 295 KB] more information	requires no parameters
Kaspersky Virus Removal Tool download [EXE, 28 MB] more information	requires no parameters
KK download [ZIP, 154Kb] more information	-p <Scan path> - scan a defined folder -f - scan hard disks -n - scan network disks -r - scan flash drives, scan removable hard disks connected via USB and Fire Wire -y - end program without pressing any key -s - silent mode (without a black window) -l <file_name> - write info into a log -v - extended log maintenance (the switch -v works only if the -l switch is entered in the command prompt) -j - restore the registry branch SafeBoot (if the registry branch is deleted, computer cannot boot in safe mode) -z – restore the services Background Intelligent Transfer Service (BITS), Windows Automatic Update Service (wuauserv), Error Reporting Service (ERSvc/WerSvc) Windows Defender (WinDefend), Windows Security Center Service (wscsvc). -t - registry clean up from the services that remain after removing the network worm using Kaspersky Lab's products. -x – restore display of hidden system files -m - monitoring mode to protect the system from getting infected -a – disable auto start from all drives
ZbotKiller download [ZIP, 101 KB] more information	-y - end program without pressing any key -s - silent mode (without a black window) . -l < file_name > - write info into a log -v - extended log maintenance (should be entered with the -l switch) -help - show the list of all parameters
TDSSKiller download [ZIP, 95 KB] more information	-l <file_name> - write info into a log -v - extended log maintenance (should be entered with the -l switch) -d - search for a specific malicious service name
KatesKiller download [ZIP, 89.7 KB] more information	-y - end program without pressing any key -s - silent mode (without a black window) . -l < file_name > - write info into a log -v - extended log maintenance (should be entered with the -l switch)
SalityKiller download [ZIP, 134 KB] more information	-p <path> - scan a defined folder -n - scan network disks -r - scan flash drives, scan removable hard disks connected via USB and Fire Wire -y - end program without pressing any key -s - silent mode (without a black window) -l <file_name> - write info into a log -v - extended log maintenance (the switch -v works only if the -l switch is entered in the command prompt) -x - restore display of hidden system files -a - disable auto start from all drives -m - monitoring mode to protect the system from getting infected -q - scan the system and then go to monitoring mode -k – the utility will scan all disks, detect files autorun.inf created by the virus Virus.Win32.Sality and eliminate them. It will also delete the executable file linked by autorun.inf, even if such file has been already disinfected.
Antiboot download [ZIP, 116 KB] more information	-l < file_name > - write info into a log The utility generates boot sector dumps (MBR) of the disks infected with the malicious program. Dump file names are <file_name>.origmbrXX and <file_name>.curedmbrXX. The files . origmbrXX contain original MBR copies (before disinfection). The files .curedmbrXX contain cured MBR copies. The XX number depends on the hard disk drive location on PCI bus. -p < folder_name > - use it to create MBR dump files on all hard disk drives.
VirutKiller download [ZIP, 105 KB] more information	-p <path> - scan a defined folder. -n - scan flash data storage devices. -r - scan removable media. -y - when the utility finishes, its window will be closed. -s - silent mode (without a black window). -l <file_name> - write info into a log. -v - extended log maintenance (the switch -v works only if the -l switch is entered in the command prompt).
XoristDecryptor download [ZIP, 89.3 KB] more information	-l < file_name > - write info into a log. -y - close the window after the utility work is over.